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SIR: 

For discussion purposes in the April 25, 2007 interview, Applicants propose the 
following amendment to claim 1: 
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1 . (Currently Amended) A method for monitoring events generated on at least one 
computer system, said method comprising the steps of: 

(a) monitoring a set of event data generated on said at least one system; 

(b) recordmgsaidsetofeventdatainadatabase; 

(c) interrogating said database to thereby select alert event data from sa ld set of event 

data according to a predefined set of rules; 

(d) reading said alert even, data and issuing an appropriate action due to satd 

generated even, said action issued according to said predefined set of rules; 



(e) detuning said action response based nn ^i„h,in, assinH to sajd, sven, 

wherein a . 

i£i3idx ^ ; . r ^,,A, ^redetermine threshold, rising an alert . 

, f ..^.ttino in helo- ~m r rH.termineri threshold, applying a 

^ ^termine »f -id event is . jtefl afla ftr ripnlficaiit in a 

context of r rr"i~"i'y f™™ ^ eventS - Ut)0n 001(1 pW " 

t Cijot JcdhiotoTi ou l o u lL om n r f n r m ui ii l ored o v r nt f. 
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